cmdline/apt-key

   1 #!/bin/sh
   2
   3 set -e
   4 unset GREP_OPTIONS
   5
   6 # We don't use a secret keyring, of course, but gpg panics and
   7 # implodes if there isn't one available
   8 GPG_CMD='gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg'
   9
  10 if ! id -u > /dev/null; then
  11         GPG_CMD="$GPG_CMD --trustdb-name /etc/apt/trustdb.gpg"
  12 fi
  13
  14 GPG="$GPG_CMD"
  15
  16 MASTER_KEYRING=""
  17 ARCHIVE_KEYRING_URI=""
  18 #MASTER_KEYRING=/usr/share/keyrings/debian-master-keyring.gpg
  19 #ARCHIVE_KEYRING_URI=http://ftp.debian.org/debian/debian-archive-keyring.gpg
  20
  21 ARCHIVE_KEYRING=/usr/share/keyrings/debian-archive-keyring.gpg
  22 REMOVED_KEYS=/usr/share/keyrings/debian-archive-removed-keys.gpg
  23
  24 add_keys_with_verify_against_master_keyring() {
  25     ADD_KEYRING=$1
  26     MASTER=$2
  27
  28     if [ ! -f "$ADD_KEYRING" ]; then
  29         echo "ERROR: '$ADD_KEYRING' not found"
  30         return
  31     fi
  32     if [ ! -f "$MASTER" ]; then
  33         echo "ERROR: '$MASTER' not found"
  34         return
  35     fi
  36
  37     # when adding new keys, make sure that the archive-master-keyring
  38     # is honored. so:
  39     #   all keys that are exported must have a valid signature
  40     #   from a key in the $distro-master-keyring
  41     add_keys=`$GPG_CMD --keyring $ADD_KEYRING --with-colons --list-keys | grep ^pub | cut -d: -f5`
  42     master_keys=`$GPG_CMD --keyring $MASTER --with-colons --list-keys | grep ^pub | cut -d: -f5`
  43     for add_key in $add_keys; do
  44         ADDED=0
  45         for master_key in $master_keys; do
  46             if $GPG_CMD --keyring $ADD_KEYRING --list-sigs --with-colons $add_key | grep ^sig | cut -d: -f5 | grep -q $master_key; then
  47                 $GPG_CMD --quiet --batch --keyring $ADD_KEYRING --export $add_key | $GPG --import
  48                 ADDED=1
  49             fi
  50         done
  51         if [ $ADDED = 0 ]; then
  52             echo >&2 "Key '$add_key' not added. It is not signed with a master key"
  53         fi
  54     done
  55 }
  56
  57 # update the current archive signing keyring from a network URI
  58 # the archive-keyring keys needs to be signed with the master key
  59 # (otherwise it does not make sense from a security POV)
  60 net_update() {
  61     if [ -z "$ARCHIVE_KEYRING_URI" ]; then
  62         echo "ERROR: no location for the archive-keyring given"
  63         exit 1
  64     fi
  65     # in theory we would need to depend on wget for this, but this feature
  66     # isn't useable in debian anyway as we have no keyring uri nor a master key
  67     if ! which wget >/dev/null 2>&1; then
  68         echo "ERROR: an installed wget is required for a network-based update"
  69         exit 1
  70     fi
  71     if [ ! -d /var/lib/apt/keyrings ]; then
  72         mkdir -p /var/lib/apt/keyrings
  73     fi
  74     keyring=/var/lib/apt/keyrings/$(basename $ARCHIVE_KEYRING)
  75     old_mtime=0
  76     if [ -e $keyring ]; then
  77         old_mtime=$(stat -c %Y $keyring)
  78     fi
  79     (cd  /var/lib/apt/keyrings; wget -q -N $ARCHIVE_KEYRING_URI)
  80     if [ ! -e $keyring ]; then
  81         return
  82     fi
  83     new_mtime=$(stat -c %Y $keyring)
  84     if [ $new_mtime -ne $old_mtime ]; then
  85         echo "Checking for new archive signing keys now"
  86         add_keys_with_verify_against_master_keyring $keyring $MASTER_KEYRING
  87     fi
  88 }
  89
  90 update() {
  91     if [ ! -f $ARCHIVE_KEYRING ]; then
  92         echo >&2 "ERROR: Can't find the archive-keyring"
  93         echo >&2 "Is the debian-archive-keyring package installed?"
  94         exit 1
  95     fi
  96
  97     # add new keys from the package;
  98
  99     # we do not use add_keys_with_verify_against_master_keyring here,
 100     # because "update" is run on regular package updates.  A
 101     # attacker might as well replace the master-archive-keyring file
 102     # in the package and add his own keys. so this check wouldn't
 103     # add any security. we *need* this check on net-update though
 104     $GPG_CMD --quiet --batch --keyring $ARCHIVE_KEYRING --export | $GPG --import
 105
 106     if [ -r "$REMOVED_KEYS" ]; then
 107         # remove no-longer supported/used keys
 108         keys=`$GPG_CMD --keyring $REMOVED_KEYS --with-colons --list-keys | grep ^pub | cut -d: -f5`
 109         for key in $keys; do
 110             if $GPG --list-keys --with-colons | grep ^pub | cut -d: -f5 | grep -q $key; then
 111                 $GPG --quiet --batch --delete-key --yes ${key}
 112             fi
 113         done
 114     else
 115         echo "Warning: removed keys keyring  $REMOVED_KEYS missing or not readable" >&2
 116     fi
 117 }
 118
 119
 120 usage() {
 121     echo "Usage: apt-key [--keyring file] [command] [arguments]"
 122     echo
 123     echo "Manage apt's list of trusted keys"
 124     echo
 125     echo "  apt-key add <file>          - add the key contained in <file> ('-' for stdin)"
 126     echo "  apt-key del <keyid>         - remove the key <keyid>"
 127     echo "  apt-key export <keyid>      - output the key <keyid>"
 128     echo "  apt-key exportall           - output all trusted keys"
 129     echo "  apt-key update              - update keys using the keyring package"
 130     echo "  apt-key net-update          - update keys using the network"
 131     echo "  apt-key list                - list keys"
 132     echo "  apt-key finger              - list fingerprints"
 133     echo "  apt-key adv                 - pass advanced options to gpg (download key)"
 134     echo
 135     echo "If no specific keyring file is given the command applies to all keyring files."
 136 }
 137
 138 # Determine on which keyring we want to work
 139 if [ "$1" = "--keyring" ]; then
 140         #echo "keyfile given"
 141         shift
 142         TRUSTEDFILE="$1"
 143         if [ -r "$TRUSTEDFILE" ]; then
 144                 GPG="$GPG --keyring $TRUSTEDFILE --primary-keyring $TRUSTEDFILE"
 145         else
 146                 echo >&2 "Error: The specified keyring »$TRUSTEDFILE« is missing or not readable"
 147                 exit 1
 148         fi
 149         shift
 150 # otherwise use the default
 151 else
 152         #echo "generate list"
 153         TRUSTEDFILE="/etc/apt/trusted.gpg"
 154         eval $(apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring)
 155         eval $(apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f)
 156         if [ -r "$TRUSTEDFILE" ]; then
 157                 GPG="$GPG --keyring $TRUSTEDFILE"
 158         fi
 159         GPG="$GPG --primary-keyring $TRUSTEDFILE"
 160         TRUSTEDPARTS="/etc/apt/trusted.gpg.d"
 161         eval $(apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d)
 162         if [ -d "$TRUSTEDPARTS" ]; then
 163                 #echo "parts active"
 164                 for trusted in $(run-parts --list $TRUSTEDPARTS --regex '^.*\.gpg$'); do
 165                         #echo "part -> $trusted"
 166                         GPG="$GPG --keyring $trusted"
 167                 done
 168         fi
 169 fi
 170 #echo "COMMAND: $GPG"
 171
 172 command="$1"
 173 if [ -z "$command" ]; then
 174     usage
 175     exit 1
 176 fi
 177 shift
 178
 179 if [ "$command" != "help" ] && ! which gpg >/dev/null 2>&1; then
 180     echo >&2 "Warning: gnupg does not seem to be installed."
 181     echo >&2 "Warning: apt-key requires gnupg for most operations."
 182     echo >&2
 183 fi
 184
 185 case "$command" in
 186     add)
 187         $GPG --quiet --batch --import "$1"
 188         echo "OK"
 189         ;;
 190     del|rm|remove)
 191         $GPG --quiet --batch --delete-key --yes "$1"
 192         echo "OK"
 193         ;;
 194     update)
 195         update
 196         ;;
 197     net-update)
 198         net_update
 199         ;;
 200     list)
 201         $GPG --batch --list-keys
 202         ;;
 203     finger*)
 204         $GPG --batch --fingerprint
 205         ;;
 206     export)
 207         $GPG --armor --export "$1"
 208         ;;
 209     exportall)
 210         $GPG --armor --export
 211         ;;
 212     adv*)
 213         echo "Executing: $GPG $*"
 214         $GPG $*
 215         ;;
 216     help)
 217         usage
 218         ;;
 219     *)
 220         usage
 221         exit 1
 222         ;;
 223 esac